Unified Android SDK Docker Builds

This repository uses one branch and one parameterized Dockerfile. All image variants are defined in variants.json and released by Git tag.

Existing Variants And Differences

Variant ID	Ubuntu	Platforms	Java default	Android APIs	NDK / CMake	Extra features
`api33-34-j11-17`	`24.04`	`linux/amd64`	`java-1.17.0-openjdk-amd64`	`33,34`	`-`	`-`
`api33-34-j17-21`	`24.04`	`linux/amd64`	`java-1.21.0-openjdk-amd64`	`33,34`	`-`	`-`
`api33-34-j11-17-u24-ma`	`24.04`	`linux/amd64,linux/arm64`	`java-1.17.0-openjdk-amd64`	`33,34`	`-`	`multi-arch`
`api33-34-j11-17-profiler`	`24.04`	`linux/amd64`	`java-1.17.0-openjdk-amd64`	`33,34`	`-`	`gradle-profiler`
`api34-35-j25-openjdk`	`24.04`	`linux/amd64`	`java-1.25.0-openjdk-amd64`	`34,35`	`-`	`-`
`api34-35-j17-21-25-ndk26`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`34,35`	`ndk 26.2.11394342`, `cmake 3.18.1/3.22.1`	`python2`
`api34-35-j17-21-25-ndk26-emu-api35`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`34,35` (+ `system-image 35`)	`ndk 26.2.11394342`, `cmake 3.18.1/3.22.1`	`python2`, `emulator`, `marathon 0.10.1`
`api34-35-j17-25`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`34,35`	`-`	`-`
`api34-35-j17-25-ndk26`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`34,35`	`ndk 26.2.11394342`, `cmake 3.18.1/3.22.1`	`python2`
`api34-35-j25-corretto`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`34,35`	`-`	`-`
`api35-36-j17-25`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`35,36`	`-`	`-`
`api35-36-j17-25-ndk29-u24-gcc14`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`35,36`	`ndk 29.0.14033849`, `cmake 4.1.1`	`python2`, `gcc14`
`api35-36-j17-21-25-ndk26-emu-api35`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`35,36` (+ `system-image 35`)	`ndk 26.2.11394342`, `cmake 3.18.1/3.22.1`	`python2`, `emulator`, `marathon 0.10.1`
`api36-37-j17-21-25`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`36,37`	`-`	`-`
`api36-37-j17-21-25-ndk26`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`36,37`	`ndk 26.2.11394342`, `cmake 3.22.1`	`python2`
`api36-37-j17-21-25-ndk26-emu-api36`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`36,37` (+ `system-image 36`)	`ndk 26.2.11394342`, `cmake 3.18.1/3.22.1`	`python2`, `emulator`, `marathon 0.10.1`
`api36-37-j17-21-25-ndk26-emu-api37`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`36,37` (+ `system-image 37`)	`ndk 26.2.11394342`, `cmake 3.18.1/3.22.1`	`python2`, `emulator`, `marathon 0.10.1`
`api36-37-j17-21-25-ndk26-emu-api36-37`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`36,37` (+ `system-image 36,37`)	`ndk 26.2.11394342`, `cmake 3.18.1/3.22.1`	`python2`, `emulator`, `marathon 0.10.1`
`api37-j17-21-25`	`24.04`	`linux/amd64`	`java-25-amazon-corretto`	`37`	`-`	`-`

Since v5 all variants are on Ubuntu 24.04 (noble, supported) and Java 23 (EOL) is replaced by Java 25. Frozen at v4, no longer rebuilt (images stay on Docker Hub): all *-j17-21-23*, *-j17-23*, api34-35-j23-* and api33-34-j11-17-u25-ma — use the j25 / u24-ma IDs above instead.

Release By Git Tag

Push a Git tag in this format:

build/<variant_id>/vN

Example:

git tag build/api34-35-j17-23-ndk26/v5
git push origin build/api34-35-j17-23-ndk26/v5

This triggers .github/workflows/publish-by-tag.yml and publishes:

DOCKER_HUB_USERNAME/android-sdk:<variant_id>
DOCKER_HUB_USERNAME/android-sdk:<variant_id>-vN

Manual Release For Missing Variants

Use .github/workflows/release-all-missing.yml (workflow_dispatch) with inputs:

release: vN
dry_run: true or false
max_parallel: parallel build limit

Behavior:

Checks each variant for android-sdk:<variant_id>-vN
Skips existing tags
Builds only missing variants
Pushes only when dry_run=false

Tools And Licenses

tools/ now supports built-in mode only (legacy lazy-dl flow removed).
Removed outdated legacy package lists and unused emulator wait script.
licenses/ is kept and copied into images to preserve non-interactive SDK license acceptance.
/opt/tools/entrypoint.sh initializes SDK state at container start.
/opt/tools/android-sdk-update.sh bootstraps commandline tools, updates SDK metadata, and accepts licenses.
/opt/tools/android-env.sh exports Android env vars and provides update_sdk / andep.
/opt/tools/android-accept-licenses.sh is an expect wrapper that auto-confirms SDK license prompts.

Distrusted CAs (eMudhra, since v4)

/opt/tools/distrust-emudhra.sh runs right after the tools are copied, before any SDK download. It removes every root whose subject matches emSign|eMudhra|AAA Certificate Services from the system bundle (!mozilla/... in /etc/ca-certificates.conf + update-ca-certificates --fresh) and from every JDK cacerts under /usr/lib/jvm, then fails the build if any remain. Reason: the eMudhra intermediate CA keys were compromised in Oct 2026 (CVE-2026-111943/111944, Java: CVE-2026-91403), which allows forged TLS for Gradle/sdkmanager/git downloads. AAA Certificate Services (Sectigo, cross-signs emSign) goes too; Google, Maven Central, Gradle and GitHub do not chain to it.

Runtime Usage In Container

source /opt/android-sdk-linux/bin/android-env.sh
sdkmanager --list
andep "platforms;android-36"
update_sdk

Java Switching (Variants With Multiple Installed JDKs)

Use this to see available Java alternatives in a container:

update-java-alternatives --list

Use this to switch active system Java:

update-java-alternatives --set <alternative_name>
java -version

If you run as a non-root user, switch Java for the current shell with:

export JAVA_HOME=<path_to_jvm>
export PATH="${JAVA_HOME}/bin:${PATH}"
java -version

Multi-JDK variants:

Variant ID	Installed Java packages	Default Java	Example switches
`api33-34-j11-17`	`openjdk-11-jdk`, `openjdk-17-jdk`	`java-1.17.0-openjdk-amd64`	`update-java-alternatives --set java-1.11.0-openjdk-amd64`
`api33-34-j17-21`	`openjdk-17-jdk`, `openjdk-21-jdk`	`java-1.21.0-openjdk-amd64`	`update-java-alternatives --set java-1.17.0-openjdk-amd64`
`api33-34-j11-17-u24-ma`	`openjdk-11-jdk`, `openjdk-17-jdk`	`java-1.17.0-openjdk-amd64`	`update-java-alternatives --set java-1.11.0-openjdk-amd64`
`api33-34-j11-17-profiler`	`openjdk-11-jdk`, `openjdk-17-jdk`	`java-1.17.0-openjdk-amd64`	`update-java-alternatives --set java-1.11.0-openjdk-amd64`
`api34-35-j17-21-25-ndk26`	`openjdk-17-jdk`, `java-21-amazon-corretto-jdk`, `java-25-amazon-corretto-jdk`	`java-25-amazon-corretto`	`update-java-alternatives --set java-21-amazon-corretto`, `update-java-alternatives --set java-1.17.0-openjdk-amd64`
`api34-35-j17-21-25-ndk26-emu-api35`	`openjdk-17-jdk`, `java-21-amazon-corretto-jdk`, `java-25-amazon-corretto-jdk`	`java-25-amazon-corretto`	`update-java-alternatives --set java-21-amazon-corretto`, `update-java-alternatives --set java-1.17.0-openjdk-amd64`
`api34-35-j17-25`	`openjdk-17-jdk`, `java-25-amazon-corretto-jdk`	`java-25-amazon-corretto`	`update-java-alternatives --set java-1.17.0-openjdk-amd64`
`api34-35-j17-25-ndk26`	`openjdk-17-jdk`, `java-25-amazon-corretto-jdk`	`java-25-amazon-corretto`	`update-java-alternatives --set java-1.17.0-openjdk-amd64`
`api35-36-j17-25`	`openjdk-17-jdk`, `java-25-amazon-corretto-jdk`	`java-25-amazon-corretto`	`update-java-alternatives --set java-1.17.0-openjdk-amd64`
`api35-36-j17-25-ndk29-u24-gcc14`	`openjdk-17-jdk`, `java-25-amazon-corretto-jdk`	`java-25-amazon-corretto`	`update-java-alternatives --set java-1.17.0-openjdk-amd64`
`api35-36-j17-21-25-ndk26-emu-api35`	`openjdk-17-jdk`, `java-21-amazon-corretto-jdk`, `java-25-amazon-corretto-jdk`	`java-25-amazon-corretto`	`update-java-alternatives --set java-21-amazon-corretto`, `update-java-alternatives --set java-1.17.0-openjdk-amd64`
`api36-37-j17-21-25`	`openjdk-17-jdk`, `java-21-amazon-corretto-jdk`, `java-25-amazon-corretto-jdk`	`java-25-amazon-corretto`	`update-java-alternatives --set java-21-amazon-corretto`, `update-java-alternatives --set java-1.17.0-openjdk-amd64`
`api36-37-j17-21-25-ndk26`	`openjdk-17-jdk`, `java-21-amazon-corretto-jdk`, `java-25-amazon-corretto-jdk`	`java-25-amazon-corretto`	`update-java-alternatives --set java-21-amazon-corretto`, `update-java-alternatives --set java-1.17.0-openjdk-amd64`
`api36-37-j17-21-25-ndk26-emu-api36`	`openjdk-17-jdk`, `java-21-amazon-corretto-jdk`, `java-25-amazon-corretto-jdk`	`java-25-amazon-corretto`	`update-java-alternatives --set java-21-amazon-corretto`, `update-java-alternatives --set java-1.17.0-openjdk-amd64`
`api36-37-j17-21-25-ndk26-emu-api37`	`openjdk-17-jdk`, `java-21-amazon-corretto-jdk`, `java-25-amazon-corretto-jdk`	`java-25-amazon-corretto`	`update-java-alternatives --set java-21-amazon-corretto`, `update-java-alternatives --set java-1.17.0-openjdk-amd64`
`api36-37-j17-21-25-ndk26-emu-api36-37`	`openjdk-17-jdk`, `java-21-amazon-corretto-jdk`, `java-25-amazon-corretto-jdk`	`java-25-amazon-corretto`	`update-java-alternatives --set java-21-amazon-corretto`, `update-java-alternatives --set java-1.17.0-openjdk-amd64`
`api37-j17-21-25`	`openjdk-17-jdk`, `java-21-amazon-corretto-jdk`, `java-25-amazon-corretto-jdk`	`java-25-amazon-corretto`	`update-java-alternatives --set java-21-amazon-corretto`, `update-java-alternatives --set java-1.17.0-openjdk-amd64`

Local Validation

./scripts/validate-variants.sh

for id in $(jq -r '.variants | keys[]' variants.json); do
  ./scripts/parse-build-tag.sh "build/${id}/v9999" >/dev/null
  ./scripts/resolve-variant.sh --variant-id "${id}" --release v9999 --docker-user example >/dev/null
done

Files

variants.json: variant source of truth
Dockerfile: parameterized build template
tools/: bootstrap and SDK helper scripts used inside image build/runtime
licenses/: Android SDK license hashes copied into the image
scripts/parse-build-tag.sh: validates/parses build/<variant_id>/vN
scripts/resolve-variant.sh: resolves build args + output tags from variants.json
scripts/list-missing-for-release.sh: finds variants missing -vN image tags
scripts/validate-variants.sh: schema/content validation
.github/workflows/publish-by-tag.yml: release by Git tag
.github/workflows/release-all-missing.yml: manual release missing variants only
.github/workflows/validate-config.yml: CI config validation

Navigation Menu

Repository navigation

About

Repository files navigation

Unified Android SDK Docker Builds

Existing Variants And Differences

Release By Git Tag

Manual Release For Missing Variants

Tools And Licenses

Distrusted CAs (eMudhra, since v4)

Runtime Usage In Container

Java Switching (Variants With Multiple Installed JDKs)

Local Validation

Files

About

Releases

Packages

Contributors

Languages

Name		Name	Last commit message	Last commit date
.github		.github
licenses		licenses
scripts		scripts
tools		tools
.gitignore		.gitignore
Dockerfile		Dockerfile
README.md		README.md
variants.json		variants.json

Latest commit

History

Folders and files

Repository files navigation

Unified Android SDK Docker Builds

Existing Variants And Differences

Release By Git Tag

Manual Release For Missing Variants

Tools And Licenses

Distrusted CAs (eMudhra, since v4)

Runtime Usage In Container

Java Switching (Variants With Multiple Installed JDKs)

Local Validation

Files

About

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages